About multivalue fields

The eval and where commands support functions, such as mvcount(), mvfilter(), mvindex(), and mvjoin() that you can use with multivalue fields. See Multivalue eval functions in the Search Reference and the examples in this topic.

Configuring multivalue fields

If you are using Splunk Enterprise, you can configure multivalue fields in the fields.conf file to specify how Splunk software detects more than one field value in a single extracted field value. Edit the fields.conf in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. For more information on how to do this, see Configure extractions of multivalue fields with fields.conf in the Knowledge Manager Manual.

If you are using Splunk Cloud and want to configure multivalue fields, file a Support ticket.

If your search produces results, such as a table, the results get written to the results.csv.gz file. The contents of the results.csv.gz file include fields that begin with "__mv_". These fields are for internal use only and are used to encode multivalue fields.

Evaluate multivalue fields

One of the more common examples of multivalue fields is email address fields, which typically appear two or three times in a single sendmail event--one time for the sender, another time for the list of recipients, and possibly a third time for the list of Cc addresses.

Count the number of values in a field

Use the mvcount() function to count the number of values in a single value or multivalue field.

In this example, mvcount() returns the number of email addresses in the To, From, and Cc fields and saves the addresses in the specified "_count" fields.

This search takes the values in the To field and uses the split function to separate the email address on the @ symbol. The split function is also used on the Cc field for the same purpose.

If only a single email address exists in the From field, as you would expect, mvcount(From) returns 1. If there is no Cc address, the Cc field might not exist for the event. In that situation mvcount(cc) returns NULL.

Filter values from a multivalue field

Use the mvfilter() function to filter a multivalue field using an arbitrary Boolean expression. The mvfilter function works with only one field at a time.

In this example, mvfilter() keeps all of the values for the field email that end in .net or .org.

Note: This example also uses the match() function to compare the pattern defined in quotes to the value of email. See Evaluation functions in the Search Reference.

Return a subset of values from a multivalue field

Use the mvindex() function to reference a specific value or a subset of values in a multivalue field. Since the index numbering starts at 0, if you want to reference the 3rd value of a field, you would specify it as 2.

In this example, mvindex() returns the first email address in the "To" field for every email sent by Sender:

eventtype="sendmail" from=Sender@* | eval to_first=mvindex(to,0)

If you want to see the top 3 email addresses that Sender writes to, use the following search.

eventtype="sendmail" from=Sender@* | eval top_three=mvindex(to,0,2)

In this example, top_three is, itself, a multivalue field.

Manipulate multivalue fields

Use nomv to convert a multivalue field into a single value

You can use the nomv command to convert values of the specified multivalue field into one single value. The nomv command overrides the multivalue field configurations that are set in fields.conf file.

In this example for sendmail events, you want to combine the values of the senders field into a single value.

eventtype="sendmail" | nomv senders

Use makemv to separate a multivalue field

You can use the makemv command to separate multivalue fields into multiple single value fields. In this example for sendmail search results, you want to separate the values of the senders field into multiple field values.

eventtype="sendmail" | makemv delim="," senders

After you separate the field values, you can pipe it through other commands. For example, you can display the top senders.

eventtype="sendmail" | makemv delim="," senders | top senders

Use mvexpand to create multiple events based on a multivalue field

You can use the mvexpand command to expand the values of a multivalue field into separate events for each value of the multivalue field. In this example, new events are created for each value in the multivalue field, "foo".

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »